CVE-2017-6889 An integer overflow error within the "foveon_load_camf()" function (dcraw_foveon.c) in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a heap-based buffer overflow.
CriticalCVSS 9.8
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An integer overflow error within the "foveon_load_camf()" function (dcraw_foveon.c) in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a heap-based buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libraw-demosaic-pack-gpl2 | <= 0.18.1 | No fix listed |
| libraw-demosaic-pack-gpl2 | = 0.x prior to 0.18.2 | No fix listed |
References
- github.com patch third-party-advisory
- secuniaresearch.flexerasoftware.com permissions-required third-party-advisory